diff mbox

video: of: display_timing: double free on error

Message ID 20140711092136.GA9339@mwanda (mailing list archive)
State New, archived
Headers show

Commit Message

Dan Carpenter July 11, 2014, 9:21 a.m. UTC
The display_timings_release() function frees "disp" and we free it
again on the next line.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

--
To unsubscribe from this list: send the line "unsubscribe linux-fbdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Tomi Valkeinen Aug. 26, 2014, 11:30 a.m. UTC | #1
On 11/07/14 12:21, Dan Carpenter wrote:
> The display_timings_release() function frees "disp" and we free it
> again on the next line.
> 
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> diff --git a/drivers/video/of_display_timing.c b/drivers/video/of_display_timing.c
> index 987edf1..5c098d5 100644
> --- a/drivers/video/of_display_timing.c
> +++ b/drivers/video/of_display_timing.c
> @@ -236,6 +236,7 @@ timingfail:
>  	if (native_mode)
>  		of_node_put(native_mode);
>  	display_timings_release(disp);
> +	disp = NULL;
>  entryfail:
>  	kfree(disp);
>  dispfail:
> 

Thanks, queued for 3.17 fbdev fixes.

The code looks a bit messy to me, though. I'm not fond of "kalloc here,
kfree there" style.

Maybe this would be slightly cleaner, if display_timings_release() would
accept NULL parameter. Then the code above could just use
display_timings_release(), and there'd be no need for kfree.

In any case, that's stuff for an other patch. This one is fine fix for 3.17.

 Tomi
diff mbox

Patch

diff --git a/drivers/video/of_display_timing.c b/drivers/video/of_display_timing.c
index 987edf1..5c098d5 100644
--- a/drivers/video/of_display_timing.c
+++ b/drivers/video/of_display_timing.c
@@ -236,6 +236,7 @@  timingfail:
 	if (native_mode)
 		of_node_put(native_mode);
 	display_timings_release(disp);
+	disp = NULL;
 entryfail:
 	kfree(disp);
 dispfail: